Getting Data In

"--splunk-cooked-mode-v3-- " in the indexer

kunalmao
Communicator

Splunkers, I am facing this issue of cooked data, I know there are many answers about it and this has been a real pain for many. I have gone through them and none of it is working. Below are my configurations , if anyone of you can point out where the error is

Forwarder - outputs.conf

[tcpout]
defaultGroup = dmc
indexAndForward = false
disabled = false

sendCookedData=false when i uncomment it I don't get any data at all , not even the cooked one

forwardedindex.2.whitelist = test_index

[tcpout:dmc]
server = xx.xx.xx.xx:9997
autoLB = true


Indexer - inputs.conf

[splunktcp://9996]
connection_host = ip

[splunktcp://9997] disabled = 0

[tcp://8097]
connection_host = dns
index = test_index
sourcetype = generic_single_line

on indexer I am receiving "--splunk-cooked-mode-v3-- " junk data. Also if anyone can then please explain a bit about cooked mode.

0 Karma
1 Solution

kunalmao
Communicator

directed to port 9996 in outputs.conf and created index=test_index on indexer and it solved the issue for me.

View solution in original post

0 Karma

kunalmao
Communicator

directed to port 9996 in outputs.conf and created index=test_index on indexer and it solved the issue for me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...